Term Tuesday: Sweepstakes or Premium Fraud explained

In our on going series explaining how Telecom Fraud works and how to protect yourself and your company here is an example of how Sweepstakes or Premium Fraud occurs.

Not all Telecom Fraud requires that the fraudster hack your phone system or take any real risk. In many cases fraudsters try to trick you into making calls or into staying on the line a long time, thus defrauding yourself. These are easier than hacking your system and can be much more profitable.

Some examples of how they get you to call can be:

• Message to your cell phone
• Voice message (automatic return the call option)
• Missed call
• Email or fax offers

In most of these cases you will be asked to call a number, they then want to keep you on the line as long as possible, and if they can do it they want to encourage you to call over and over again by offering you chances to win. I came across one example recently that explains this clearly:

Thank you for calling dial to win applications, where you can win fabulous prizes every week, the longer you hold the line the bigger is your chance to be the winner, for every minute you hold you collect one lucky hit, the more lucky hits you collect the the bigger your chances, now get ready we will generate you unique code 322123179325. 

Well done, you have collected you first lucky hit for this call, please continue to hold etc...

What they don't tell you is that you are not calling a toll-free number and in fact can be paying more than $5 per minute, and there have been cases of over $20 per minute.

Be wary of these scams.

To read more about this type of fraud see:

• Premium Rate Phone Fraud Hoax: www.hoax-slayer.com/premium-phone-rate-hoax.html
• Missed calls & text messages from unknown numbers: www.scamwatch.gov.au/content/index.phtml/itemId/693789
• Scams: 1-900 Numbers: www.spamlaws.com/900-scams.htm
• The Sweepstakes Fraud: www.about-the-web.com/shtml/reports/sweepstakes_fraud.shtml
• Mobile phone fraud: www.actionfraud.org.uk/protect-yourself/mobile-phone-fraud

Guest blogging on Peer-to-Peer blog: 2011's Biggest Frauds and Phreaks

I have another Guest Blog published on Channel Partners Magazine’s Peer-to-Peer blog

2011's Biggest Frauds and Phreaks 

It reviews the many news stories about Telecom Fraud that occurred during the year.

Shssshhhhhh!!!! Al-Qaeda Phreaking!

Humbug Telecom Lab’s Eric Klein will be making a guest appearance on VoIP Users Conference weekly discussion:

Topic:  As shown by the recent arrest in the case of terrorist who were hacking AT&T business customers to fund Al-Qaeda; Telecom Fraud has come a long way from Captain Crunch and Steve Jobs phreaking Ma Bell for fun and glory. It is now big business aimed at stealing from you via your PBX. Let’s discuss actual cases and some things you can do to make sure your PBX is not funding terror.

Friday at December 2^nd at 12 Noon Eastern Time (9AM Pacific)

To connect see instructions on http://www.voipusersconference.org/how-to-participate/date-and-time/

Astricon updates

Rather than another Fraud Terms Tuesday today I bring you 2 links from Astricon.

In the first, Tom Keating from TMC Net caught me and Nir running the first part of the Security Round Table. Here is his blog entry about it AstriCon VoIP Security - $400,000 toll fraud - YIKES! and here is the video he took at the start of the session.

Later that day we were interviewed by Chris DiMarco, also from TMC Net. Here is the link to his article  Saying Humbug to Telephony Fraud.

SEC asks companies to disclose cyber attacks - is Telecom Fraud next

According to an article in today Reuters the SECasks companies to disclose cyber attacks set new guidelines on Thursday about cyber events that could lead to monetary losses.

U.S. securities regulators formally asked public companies for the first time to disclose cyber attacks against them, following a rash of high-profile Internet crimes. 

Senator John Rockefeller has asked the SEC to set guidelines related to losses due to security breaches.

"Intellectual property worth billions of dollars has been stolen by cyber criminals, and investors have been kept completely in the dark. This guidance changes everything," Rockefeller said in a statement.

"It will allow the market to evaluate companies in part based on their ability to keep their networks secure. We want an informed market and informed consumers, and this is how we do it," Rockefeller said in a statement.

Now as the SEC asks companies to disclose financial affecting cyber attacks, here is a question to ponder is telecom fraud next? It is almost entirely financial, and has the possibility of exposing intellectual property and customer information while by-passing normal cyber security procedures.

Consider for a minute, with more than $80 billion worth of telecom fraud happening each year, how long will it be before companies are required to disclose this to stockholders or the SEC?

What is the fiscal responsibility of a company’s management to protect and or disclose this risk to stockholders?

What are you doing to protect your company?

Proactive monitoring and active security are a must to protect companies from this kind of loss.

For suggestions on how you can protect your company please see my guest blog Telecom Fraud Is Alive & Kickin’ or visit the Humbug Labs site to sign up for analytics and Fraud Detection.

Term Tuesdays - Telecom Fraud Explained

Each Tuesday I will be attempting to explain a different Telecom Fraud related term or concept. 


Where possible, I will include real world examples. For some cases I may not be allowed to release the specific information about the customer and then will provide the cases in general terms.

Topics will include

• Calls to Known Fraudulent Numbers or Destinations
• Hacking
• Internal Misconduct
• Malware
• Off Hour Call
• PBX Dial-Through
• Phishing
• Proactive Monitoring
• Service & Application Level Fraud
• Subscription Fraud

As this is intended to be educational I will try to include links to original articles or sources where the information originated, where they exist. Many of these will be related to white papers I, or my coworkers publish on the Humbug Telecom Labs site.

Where they are applicable to a specific market segment or product type, I will identify them.

When ever possible I will give tips or suggestions on how to prevent this type of fraud.

Guest blogging at Channel Partners Magazine’s Peer-to-Peer blog

You can read my guest blog Channel Partners Magazine’s Peer-to-Peer blog

Telecom Fraud Is Alive & Kickin’

Why isn't everyone hacked every day? VoIP security is not the same as on PC

Michael Kassner has a good interview on TechRepublic today called Why isn't everyone hacked every day? In this article he interviews Microsoft Principal Researcher, Cormac Herley, along with Dinei Florencio, also a Microsoft Researcher about their paper “Where Do All the Attacks Go?"

Now, both the article and the paper are quite informative, but the conclusions they give are valid for personal and corporate computer networks but do not translate to VoIP Security.

So let me explain why. First the premise of the paper is what we thought we know about security is not correct.

“Internet security has a puzzling fact at its core. If security is only as strong as the weakest link; then all who choose weak passwords, reuse credentials across accounts, fail to heed security warnings or neglect patches and updates, should be hacked — regularly and repeatedly.Clearly this fails to happen.”

VoIP not so safe says Ian Kilpatrick

Ian Kilpatrick has written a nice piece highlighting the problems with how people deal with VoIP Security as they extend services.  In his article VoIP not so safe he says that

Many companies have now adopted VoIP, and many more are considering adopting it. But they don't necessarily realise that, by moving to VoIP, they have also moved into converged (phone/data) systems and a potentially dangerous security environment.

As companies deal with both the advent of VoIP services and employees connecting their mobile devices to the company network service the risks to the company increase exponentially.


I have  a new whitepaper that offers some insights to the Benefits of Telecom Analytics and Fraud Detection for Enterprises that shows some of the risks companies face and ways to deal with them.